Re: [RFT PATCH] hwmon: (pmbus) Fix type confusion in notification logic

Hi Guenter,

> However, data->group.attrs can contain other types like struct
> pmbus_samples_reg or struct pmbus_sensor, which only embed a base
> struct device_attribute.
> 
> If da is a struct pmbus_samples_reg, dev_attr is the last member. Casting
> it to struct sensor_device_attribute and reading the index field appears
> to access memory past the end of the allocation, which might trigger a
> slab-out-of-bounds read.
> 
> Additionally, if da is a struct pmbus_sensor, casting it causes the index
> field to overlap with the page, phase, and reg fields. Could this produce
> a garbage mask on little-endian systems that spuriously matches the target
> reg, page, and flags during an alert?
> 
> Fix the problem by using struct sensor_device_attr in struct pmbus_sensor
> and struct pmbus_label. Since those attributes never trigger a
> notification, set the value of attr->index to -1 for them. Use this value
> to distinguish from boolean attributes which _can_ trigger a notification
> and use the index field to encode mask, page, and register values.
> 
> Fixes: f469bde9afd1 ("hwmon: (pmbus/core) Notify hwmon events")
> Cc: Vincent Jardin <[email protected]>
> Signed-off-by: Guenter Roeck <[email protected]>
> ---
> RFT: Build-tested only

I tested on my board today but I did cherry pick the the 5 commits from:
  https://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging.git/log/?h=hwmon-next
	hwmon: (pmbus) Fix type confusion in notification logic <-- this RFT
	hwmon: (pmbus/mpq8646) Gate the writes
	hwmon: (pmbus) Add MPQ8646 driver
	dt-bindings: hwmon: pmbus: add MPS MPQ8646
	hwmon: (pmbus/core) export pmbus_check_and_notify_faults()

Beside testing it with the attributes and boolean alarms of the MPQ8646, I did
test it with the board's PSU that is another PMBUus device and exposes some attributes
and boolean alarms too.

Both were OK.

Tested-by: Vincent Jardin <[email protected]>

best regards,
  Vincent